美国联邦信息和通信技术中国供应链漏洞(英文 52 页)

---

Supply Chain Vulnerabilities from China in U.S. Federal Information and Communications Technology

美中经济与安全评估委员会发布了一份题为“美国联邦信息和通信技术中国供应链漏洞”的报告，该报告由Interos Solutions公司为委员会编写。报告审查了美国政府信息和通信技术（ICT ）中国构成的供应链，并对供应链风险管理提出建议。

Table of Contents

Acronyms........ iii

Executive Summary......... v

Recommendations for a National SCRM Strategy........... vi

Embrace an Adaptive Supply Chain Risk Management (SCRM) Process.......... vi

Centralize Federal ICT SCRM Efforts........... vii

Link Federal Regulations to Appropriations.......... vii

Promote Supply Chain Transparency and Partnership with Industry........... vii

Craft Forward-Looking Policy........... viii

Chapter 1: U.S. Government ICT Supply Chains........1

The Federal ICT Ecosystem.......1

Quantifying the China Supplier Nexus..........2

Tracing the China Supplier Nexus.......3

Chapter 2: SCRM Laws, Regulations, and Other Requirements..........6

Federal Information Systems and NIST.........6

National Security Systems and the CNSS...........7

Executive Branch and SCRM..........8

Congressional Action and SCRM.......10

Federal Information Technology Acquisition Reform Act .......10

Federal Information Security Modernization Act and Circular A-130.........11

Cybersecurity Enhancement Act .........12

Chapter 3: Supply Chain Analysis of Federal ICT Manufacturers........... 13

Supplier Location..........13

Supplier Financing and Influence...........13

Supply Chain Risk Case Study: Corporate Intelligence-Sharing Agreements..........16

Intel and IBM: (In)Security Partnerships........16

VMware Partnerships with Chinese SOEs and Kaspersky.......17

Chapter 4: China’s Political and Economic Agenda Is Behind the Supply Chain Security Dilemma........... 19

Prioritizing Indigenous ICT Production.......19

Raising Security Concerns.......20

ii Supply Chain Vulnerabilities from China in U.S. Federal Information and Communications Technology

Extracting Concessions from Multinationals........21

Using Chinese Companies to Further State Goals .........24

Targeting U.S. Government Contractors..........27

Chapter 5: Closing Loopholes: Recommended SCRM Actions.......... 29

Establishing Centralized Leadership for SCRM...........29

Expanding the Wolf Provision...........30

Promoting Supply Chain Transparency.......31

Dodd-Frank Limitations Are Future SCRM Lessons.......32

Utilizing Federal Acquisition Authorities.........33

Chapter 6: Future Considerations........... 34

Conclusions......... 38

Scope Note.......... 40

Methodology...........40

Sources..........41

Acknowledgments......... 42